From ab7186a486347216fde099498471cf847828565c Mon Sep 17 00:00:00 2001 From: Olivier Certner Date: Wed, 27 Aug 2025 16:56:21 +0200 Subject: [PATCH] MAC/bsdextended: Restore matching subjects' effective GID Fixes: be1f7435ef218b1d ("kern: start tracking cr_gid outside of cr_groups[]") MFC after: 5 days MFC to: stable/15 Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D52270 --- sys/security/mac_bsdextended/mac_bsdextended.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c index 8a654921438..bf95c008e2f 100644 --- a/sys/security/mac_bsdextended/mac_bsdextended.c +++ b/sys/security/mac_bsdextended/mac_bsdextended.c @@ -246,7 +246,9 @@ ugidfw_rulecheck(struct mac_bsdextended_rule *rule, } if (rule->mbr_subject.mbs_flags & MBS_GID_DEFINED) { - match = ((cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && + match = ((cred->cr_gid <= rule->mbr_subject.mbs_gid_max && + cred->cr_gid >= rule->mbr_subject.mbs_gid_min) || + (cred->cr_rgid <= rule->mbr_subject.mbs_gid_max && cred->cr_rgid >= rule->mbr_subject.mbs_gid_min) || (cred->cr_svgid <= rule->mbr_subject.mbs_gid_max && cred->cr_svgid >= rule->mbr_subject.mbs_gid_min));